I've seen that NAI's engine is now able to detect Bagle.h even if contained in passworded zip files.
03/02/2004 17:29:04 Qb64d05700068a0de Scanner 2: Virus=W32/Bagle.h!pwdzip virus !!! Attachment=Readme.zip [18] I 03/02/2004 17:29:04 Qb64d05700068a0de File(s) are INFECTED [[Encrypted .ZIP file]: 13] 03/02/2004 17:29:05 Qb64d05700068a0de Scanned: CONTAINS A VIRUS [MIME: 2 21347] Markus > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Tuesday, March 02, 2004 4:05 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.Virus] "[Encrypted .ZIP file]" > > > >The interim release 1.78i5 appears to be making headway against the > >encrypted .zip file but it appears that the sender is > forged. Is this > >suppose to be added to the SKIPIFFORGING database or should > I add it to > >the SKIPIFVIRUSNAMEHAS list and if so what should it be listed as? > >"Encrypted .ZIP file".? > > Yes, that should work fine. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers since 2000. > Declude Virus: Catches known viruses and is the leader in > mailserver vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
